CVE-2026-69159

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-69159
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69159.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-69159
Aliases
Downstream
Published
2026-08-19T18:02:01.016Z
Modified
2026-08-21T08:19:17.361864Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVSS Calculator
Summary
FreeRDP: Out-of-Bounds Read in Planar RLE Decoder (planar_decompress_plane_rle / planar_decompress_plane_rle_only)
Details

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.29.0, planardecompressplanerle and planardecompressplanerle_only in libfreerdp/codec/planar.c verify that a control byte exists but do not verify that the source buffer contains the zero to fifteen raw bytes declared by that control byte. A malicious RDP server can send a truncated planar bitmap or surface update whose final control byte claims additional raw bytes, causing the decoder to read beyond pSrcData while processing a color plane. This can crash the client and may disclose adjacent memory. This issue is fixed in version 3.29.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69159.json"
}
References

Affected packages

Git / github.com/freerdp/freerdp

Affected ranges

Type
GIT
Repo
https://github.com/freerdp/freerdp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
75a1ec61d444179ea64a4ec0835214cb9c4f7c18
Fixed
743f437f434c6814d3ba265c75cab14673bc2911
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.29.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0-beta1
1.0-beta2
1.0-beta4
1.0-beta5
1.0.0
1.0.1
1.1.0-beta+2013071101
1.1.0-beta1
1.1.0-beta1+android2
1.1.0-beta1+android3
1.1.0-beta1+android4
1.1.0-beta1+android5
1.1.0-beta1+ios1
1.1.0-beta1+ios2
1.1.0-beta1+ios3
1.1.0-beta1+ios4
1.2.0-beta1+android7
1.2.0-beta1+android9
2.*
2.0.0
2.0.0-beta1+android10
2.0.0-beta1+android11
2.0.0-rc0
2.0.0-rc1
2.0.0-rc2
2.0.0-rc3
2.0.0-rc4
3.*
3.0.0
3.0.0-beta1
3.0.0-beta2
3.0.0-beta3
3.0.0-beta4
3.0.0-rc0
3.1.0
3.2.0
3.3.0
3.4.0
3.5.0
3.5.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69159.json"
vanir_signatures 
[
    {
        "target": {
            "file": "libfreerdp/codec/planar.c"
        },
        "deprecated": false,
        "source": "https://github.com/freerdp/freerdp/commit/75a1ec61d444179ea64a4ec0835214cb9c4f7c18",
        "id": "CVE-2026-69159-0880cffd",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "27849217718689435991094644549533067373",
                "330466484407745871725736437760670491271",
                "80073404428391480251712932393450173741",
                "261001702374105619193270458760309755668",
                "63675614114464460621665949122657701870",
                "62009279958888338180346056134844185964",
                "74150560493707942088160864300186752787",
                "70925389120791971072611096487457394788",
                "327814285679698029107220909819173221397",
                "310640586733257055085103457471420890074",
                "184323606363654880000914300897265591212",
                "213803863262817505090339396184146089570",
                "288487140662162537619658883480763855112",
                "330535352613304883502346657432717482656",
                "231053980863702437772785515408396792972",
                "52759110020082854668681720004031191647",
                "217872604885205727096975241901139257090",
                "165711913403684607366050233056482056354",
                "71421593515170996995518312805610525199",
                "64860654166284036395545354433006354967",
                "246244260403458151529397176318974116329",
                "117538364606468935250934263228811690054",
                "333074141710635353878506192750459148821",
                "304881063991969741106492343000375513798",
                "156582868962061421882097621119996987260",
                "29154988636652661120278530386215818842",
                "242158531111550419166868345863714063292",
                "120624498408035481428454841931463883231",
                "242934823772699756440916650077543221706",
                "9845111677293244750558433704125257408",
                "240658171763010388864740138699375570781",
                "42189618431311834153659185052785430112",
                "62009279958888338180346056134844185964",
                "74150560493707942088160864300186752787",
                "70925389120791971072611096487457394788",
                "327814285679698029107220909819173221397",
                "17387782426600102863121283949608853582",
                "171953216901910294902162235053050328417",
                "268844811168571583563133759091913084225",
                "184467716870163907870314573302990440941",
                "330535352613304883502346657432717482656",
                "231053980863702437772785515408396792972",
                "52759110020082854668681720004031191647",
                "217872604885205727096975241901139257090",
                "165711913403684607366050233056482056354",
                "71421593515170996995518312805610525199",
                "102046830557018794875598846466960760944",
                "95255113091948098839760179836606697688",
                "310807019588370299146564214757343785383",
                "333074141710635353878506192750459148821",
                "304881063991969741106492343000375513798",
                "156582868962061421882097621119996987260",
                "166636793809927508871583045932664331358",
                "178348640798977195011925290645089812535",
                "338342262528130457801918525779894704640",
                "155386640405202161036468915226519349721",
                "9845111677293244750558433704125257408"
            ]
        },
        "signature_type": "Line"
    }
]
vanir_signatures_modified 
"2026-08-21T08:19:17Z"